Scheduled Delta Synchronization Fails Due to Disabled SSL

Still need help?

The Atlassian Community is here for you.

Ask the community

Symptoms

Confluence is unable to perform delta synchronization with Active Directory and the following appears in the atlassian-confluence.log:

2012-08-09 09:24:27,640 INFO [scheduler_Worker-8] [atlassian.crowd.directory.DbCachingRemoteDirectory] synchroniseCache synchronisation for directory [ 48398337 ] starting
2012-08-09 09:24:27,718 INFO [scheduler_Worker-8] [atlassian.crowd.directory.DbCachingRemoteDirectory] synchroniseCache delta synchronisation complete in [ 78ms ]
2012-08-09 09:24:27,767 ERROR [scheduler_Worker-8] [atlassian.crowd.directory.DbCachingDirectoryPoller] pollChanges Error occurred while refreshing the cache for directory [ 48398337 ].
com.atlassian.crowd.exception.OperationFailedException: org.springframework.ldap.AuthenticationNotSupportedException: [LDAP: error code 8 - 00002028: LdapErr: DSID-0C0901FC, comment: The server requires binds to turn on integrity checking if SSL\TLS are not already active on the connection, data 0, v1db0]; nested exception is javax.naming.AuthenticationNotSupportedException: [LDAP: error code 8 - 00002028: LdapErr: DSID-0C0901FC, comment: The server requires binds to turn on integrity checking if SSL\TLS are not already active on the connection, data 0, v1db0]
        at com.atlassian.crowd.directory.SpringLDAPConnector.pageSearchResults(SpringLDAPConnector.java:333)
        at com.atlassian.crowd.directory.SpringLDAPConnector.searchEntitiesWithRequestControls(SpringLDAPConnector.java:366)
        at com.atlassian.crowd.directory.MicrosoftActiveDirectory.findTombstonesSince(MicrosoftActiveDirectory.java:368)
        at com.atlassian.crowd.directory.MicrosoftActiveDirectory.findUserTombstonesSince(MicrosoftActiveDirectory.java:309)
        at com.atlassian.crowd.directory.ldap.cache.UsnChangedCacheRefresher.synchroniseUserChanges(UsnChangedCacheRefresher.java:308)
        at com.atlassian.crowd.directory.ldap.cache.UsnChangedCacheRefresher.synchroniseChanges(UsnChangedCacheRefresher.java:161)
        at com.atlassian.crowd.directory.DbCachingRemoteDirectory.synchroniseCache(DbCachingRemoteDirectory.java:610)
        at com.atlassian.crowd.manager.directory.DirectorySynchroniserImpl.synchronise(DirectorySynchroniserImpl.java:63)
        at com.atlassian.crowd.directory.DbCachingDirectoryPoller.pollChanges(DbCachingDirectoryPoller.java:50)
        at com.atlassian.crowd.manager.directory.monitor.poller.DirectoryPollerJobBean.executeInternal(DirectoryPollerJobBean.java:29)
        at org.springframework.scheduling.quartz.QuartzJobBean.execute(QuartzJobBean.java:86)
        at org.quartz.core.JobRunShell.run(JobRunShell.java:199)
        at com.atlassian.confluence.schedule.quartz.ConfluenceQuartzThreadPool$1.run(ConfluenceQuartzThreadPool.java:20)
        at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:549)
Caused by: org.springframework.ldap.AuthenticationNotSupportedException: [LDAP: error code 8 - 00002028: LdapErr: DSID-0C0901FC, comment: The server requires binds to turn on integrity checking if SSL\TLS are not already active on the connection, data 0, v1db0]; nested exception is javax.naming.AuthenticationNotSupportedException: [LDAP: error code 8 - 00002028: LdapErr: DSID-0C0901FC, comment: The server requires binds to turn on integrity checking if SSL\TLS are not already active on the connection, data 0, v1db0]
        at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:183)
        at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:319)
        at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:237)
        at com.atlassian.crowd.directory.SpringLDAPConnector.pageSearchResults(SpringLDAPConnector.java:300)
        ... 13 more
Caused by: javax.naming.AuthenticationNotSupportedException: [LDAP: error code 8 - 00002028: LdapErr: DSID-0C0901FC, comment: The server requires binds to turn on integrity checking if SSL\TLS are not already active on the connection, data 0, v1db0]
        at com.sun.jndi.ldap.LdapReferralContext.<init>(LdapReferralContext.java:74)
        at com.sun.jndi.ldap.LdapReferralException.getReferralContext(LdapReferralException.java:132)
        at com.sun.jndi.ldap.LdapCtx.searchAux(LdapCtx.java:1838)
        at com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1749)
        at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(ComponentDirContext.java:368)
        at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:338)
        at javax.naming.directory.InitialDirContext.search(InitialDirContext.java:257)
        at sun.reflect.GeneratedMethodAccessor402.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at org.springframework.ldap.transaction.compensating.manager.TransactionAwareDirContextInvocationHandler.invoke(TransactionAwareDirContextInvocationHandler.java:92)
        at $Proxy1075.search(Unknown Source)
        at org.springframework.ldap.core.LdapTemplate$3.executeSearch(LdapTemplate.java:231)
        at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:293)
        ... 15 more

Diagnosis

Manual synchronization by clicking on the "Sychronize" links works without any errors. However, a delta synchronization fails. The Active Directory is not using SSL.

Cause

The Active Directory server requires SSL to be enabled in order to perform synchronization with Confluence. This depends on the security setting and configuration of the AD server; usually, this error occurs when Domain Controller option is set to "Require Signature".

Resolution

  1. Ensure that SSL in AD is enabled. Refer to the following guide for more information: Configuring an SSL Connection to Active Directory
  2. Update the URL for AD server to include the SSL port (636) and ensure that the SSL option is enabled in the User Directory Configuration for AD in Confluence
Last modified on Mar 30, 2016

Was this helpful?

Yes
No
Provide feedback about this article
Powered by Confluence and Scroll Viewport.